Security & Encryption
Last updated: 14 October 2026
A plain-language summary of security controls visible in the current hosted Vexen Mail application configuration. It does not represent a certification or a guarantee that every layer of the hosting environment has been independently audited.
Encryption in transit
The hosted webmail is served over HTTPS. The application connects to the mail server using IMAP over TLS and submits outbound mail using SMTP STARTTLS as configured. Email transport beyond Vexen’s mail server depends on the receiving mail system and may not be encrypted end to end.
Encryption at rest and end-to-end encryption
Vexen Mail is not end-to-end encrypted. The service must access mail to provide mailbox, search, and delivery functions, so authorized service operators with system access may be able to access message content. The current application configuration does not establish or verify encryption at rest for mailbox storage, account database, logs, or backups; do not assume those layers are encrypted.
Accounts and operational safeguards
The hosted app uses a secure, HttpOnly session cookie with a limited session lifetime, and the backend includes CSRF and origin checks. These controls reduce certain risks but do not remove the need for strong unique passwords, secure devices, and timely reporting of suspected compromise.
Hosting, scanning, and reporting
The hosting region is not published in this release; contact support@vexenlabs.com for current location details. Malware scanning is not currently provided as a service. Scan attachments with trusted endpoint security before opening them. To report a suspected vulnerability or account incident, email support@vexenlabs.com and include steps to reproduce without sending sensitive message content.